# Verified Access

Last updated: August 14, 2026

This page covers Chromebook Verified Access, a security feature that ensures only unmodified, policy-compliant devices can connect to the enterprise network by providing hardware-backed cryptographic guarantees of device identity and user identity. Administrators can configure whether enterprise extensions may interact with the Trusted Platform Module, control content protection playback, and specify service account email addresses with limited access to the Verified Access APIs for device verification and data access. The profile can be applied as either a user or device profile.

Verified Access as the name suggests, is a feature which ensures every device connecting to the enterprise network is unmodified and complies with the enterprise policies. Verified Access serves as the entry point for a network entity to get a hardware-backed cryptographic guarantee of both the device identity as well as the identity of the device user. You can know more about [Verified Access here](https://cloud.googleblog.com/2016/09/pushing-the-boundary-of-Chrome-OS-Security-with-Verified-Access.html). This profile can be applied either as a user profile or device profile, with the configurations getting applied to user or device based on the profile type.

## Profile Description

| Profile Specification | Description |
|---|---|
| Verified Access for Enterprise Extensions | Allow/Restrict interaction of Chrome extensions in user sessions with [Trusted Platform Module](https://www.chromium.org/developers/design-documents/tpm-usage) |
| Verified Access for Content Protection | Allow/Restrict protected content from being played on the device |
| Service Accounts Allowed to verify device | Specify the list of e-mail address that have limited access to the Verified Access APIs to verify device |
| Service Accounts Allowed to verify device and access device data | Specify the list of e-mail address that have limited access to the Verified Access APIs to verify device and access device data. |

## Frequently Asked Questions

**Can Verified Access be applied as both a device profile and a user profile?**

Yes, this profile can be applied either as a user profile or a device profile, with the configurations getting applied to the user or the device based on the profile type.

**What does Verified Access actually verify?**

It gives a network entity a hardware-backed cryptographic guarantee of both the device's identity and the identity of the device user before granting access to the enterprise network.

**Who can use the Verified Access APIs to check a device?**

Only the e-mail addresses you specify under "Service Accounts Allowed to verify device" (or the extended list for accessing device data) get limited API access for verification.